Improper Authentication in Cloud Foundation and vCenter Server - CVE-2021-21986

Vulnerability identifier: #VU53596

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-21986

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests to the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A remote non-authenticated attacker can bypass authentication process and gain unauthorized access to the application.

Cloud Foundation
vCenter Server
Dell Enterprise Hybrid Cloud
IBM Cloud Pak System
PowerFlex Appliance
EMC Integrated Data Protection Appliance
Dell EMC VxRail Appliance

Install updates from vendor's website.

Cloud Foundation - addressed in versions 3.10.2.1, 4.2.1
vCenter Server - addressed in versions 6.5 U3p, 6.7 U3n, 7.0 U2b
IBM Cloud Pak System - update to 2.3.3.4
Dell Enterprise Hybrid Cloud - update to 4.1.2
PowerFlex Appliance - addressed in versions Intelligent_Catalog_37_361_00_r14, Intelligent_Catalog_37_355_00_r16
EMC Integrated Data Protection Appliance - update to 2.7.0
Dell EMC VxRail Appliance - update to 4.5.461

• https://www.vmware.com/security/advisories/VMSA-2021-0010.html

• Multiple vulnerabilities in VMware vCenter Server
• Dell EMC Enterprise Hybrid Cloud update for VMware products
• Multiple Vulnerabilities IBM Cloud Pak System
• Multiple vulnerabilities in Dell Integrated Data Protection Appliance
• Multiple vulnerabilities in Dell PowerFlex Appliance
• Multiple vulnerabilities in Dell VxRail Appliance